Description

OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors.

Remediation

References

CVE-2009-3245

Related Vulnerabilities

Lodash Other Vulnerability (CVE-2020-28500)

osTicket Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2021-42235)

MediaWiki Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-6335)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-43497)

WordPress Plugin Easiest Contact Form for WordPress-AP Contact Form includes Backdoor [Only if downloaded via the vendor website] (1.0.6)

Severity

Critical

Classification

CVE-2009-3245 CWE-20

Tags

Missing Update Known Vulnerabilities